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REMARKS 

This Application has been carefully reviewed in light of the Office Action mailed 
March 24, 2005. Claims 1-13 were pending in the Application. In the Office Action, Claims 
1-13 were rejected. Claims 1-13 remain pending in the Application. Applicants respectfully 
request reconsideration and favorable action in this case. 

In the Office Action, the following actions were taken or matters were raised: 

SFCTTON 102 RF.TFrTTONS 

Claims 1 and 3-10 were rejected under 35 U.S.C. 102(e) as being anticipated by U.S. 
Patent No. 6,725,377 issued to Kouznetsov (hereinafter "Kouznetsov"). Applicants 
respectfully traverse this rejection. 

Of the rejected claims, Claim 1 is independent. Applicants respectfully submit that 
Kouznetsov does not disclose or even suggest each and every limitation of independent Claim 
1. For example, independent Claim 1 recites a "mobile d^dce opprahle in a mnhii^ 
telecommunications network " having "a memory module" and "an operating system operable 
to execute an intrusion detection application stored in the memory module." Applicants 
respectfully submit that Kouznetsov does not disclose or even suggest "an intrusion detection 
application stored in the memory module" of a "mobile device operable in a mobile 
telecommunications network" as recited by independent Claim 1, nor has the Examiner 
explicitly identified any such disclosure in Kouznetsov, Thus, for at least this reason, 
Kouznetsov does not anticipate independent Claim 1 . 

Claims 3-10 that depend from independent Claim 1 are also not anticipated by 
Kouznetsov at least because they incorporate the limitations of Claim 1 and also add 
additional elements that further distinguish Kouznetsov, Therefore, Applicants respectfully 
request that the rejection of Claims 3-10 be withdrawn. 
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SFrTTON 103 T1F.IFCTTONS 

Claims 11-13 were rejected under 35 U.S.C. 103(a) as being unpatentable over U.S. 
Patent No. 6,851,061 issued to Holland III et al. (hereinafter "Holland') in view U.S. Patent 
No. 5,557,742 issued to Smaha et al. (Hereinafter "Smaha"). Claim 2 was rejected under 35 
U.S.C. 103(a) as being unpatentable over Kouznetsov in view Holland. Applicants 
respectfully traverse these rejections. 

Claim 2 depends from independent Claim 1. At least for the reasons discussed above, 
independent Claim 1 is in condition for allowance. Therefore, Claim 2 that depends 
therefrom is also in condition for allowance. Accordingly, for at least this reason, Applicants 
respectfully request that the rejection of Claim 2 be withdrawn. 

Of the remaining rejected claims, Claim 11 is independent. Applicants respectfully 
submit that neither Holland nor Smaha, alone or in combination, discloses, teaches or 
suggests the limitations of independent Claim 11. For example, independent Claim 11 
recites, at least in part, "an intrusion protection system management application, the 
management application operable to receive text-file input defining a network-exploit rule 
and convert the text-file input into a signature file comprising machine-readable logic 
representative of an exploit-signature." The Examiner admits that Holland does not disclose 
at least the above-referenced limitation(s) (Office Action, page 6), but the Examiner states 
that Smaha discloses such limitation(s), and that it would have been obvious to combine the 
purported teachings of Smaha with Holland to arrive at Applicants' invention as defined by 
Claim 1 1 . Applicants respectfully disagree. 

In the Office Action, the Examiner refers to reference numerals 20 and 12 as 
corresponding to the "intrusion protection system management application . . . operable to 
receive text-file input defining a network-exploit rule" recited by Claim 1 1 ("For instance, 
input mechanism shown on figure 1, ref. Num '20' receives input from any wide array of 
sources" (Office Action, page 6)). The Examiner then refers to the misuse engine 30 of 
Smaha as corresponding to "converting] the text-file input into a signature file comprising 
machine-readable logic representative of an exploit-signature" recited by Claim 1 1 ("The 
misuse engine shown on figure 1, ref Num '30' converts the input into events/signature and 
compare[s] it with the known signatures" (Office Action, page 6)). Thus, the Examiner 

Page 5 



Application Serial No. 10/001 J 28 



PATENT 



appears to refer to at least two different elements of the Smaha reference in order to piece 
together the purported functions of such elements to arrive at Applicants' "intrusion 
protection system management application" that "receive[s] text-file input defining a 
network-exploit rule and converts] the text-file input into a signature file comprising 
machine-readable logic representative of an exploit-signature" (emphasis added). Thus, for at 
least this reason, the Examiner's rejection of Claim 1 1 is improper. 

Further, in the Office action, the Examiner asserts that the misuse engine 30 of Smaha 
"converts the input into events/signature and compare[s] it with the known signatures" 
(Office Action, page 6). Applicants respectfully disagree. The Examiner refers to figure 5a 
of Smaha and, in particular, reference numeral 144 of figure 5a which illustrates "convert to 
event" corresponding to "process inputs" indicated by reference numeral 12 of Smaha (Office 
Action, page 6; Smaha, figure 5a). Smaha appears to disclose that misuse engine 30 of 
Smaha receives process inputs 12 in the form of data and records from security state data 
source [14], log file data source 16, and audit trail records source 18 {Smaha, column 6, lines 
1-5, figures 1 and 5a). Smaha also appears to disclose that misuse engine 30 converts the 
process inputs 12 into events and compares the event* to signature {Smaha, column 6, lines 
9-11). Thus, Smaha appears to disclose that information such as log records and audit records 
are converted to an "event" (defined as "an instant security state of the system" at column 5, 
lines 7-8 of Smaha), and then Smaha compares the event to a signature. In contrast, Claim 1 1 
recites "an intrusion protection system management application . . . operable to receive text- 
file input defining a netWOrk-CXploit nilo and convert th e teyt-file input into a signature file 

comprising machine-readable logic representative of an exploit-signature" (emphasis added). 
Accordingly, neither the portion of Smaha referred to by the Examiner nor elsewhere in 
Smaha appears to disclose, teach or suggest at least this limitation(s) of Claim 11. To the 
contrary, in Smaha, the "convert to event" corresponding to reference numeral 144 of Smaha 
referred to by the Examiner is clearly not a "network-exploit rule" nor is the information 
referred to by the Examiner "convert[ed] . . . into a signature file comprising machine- 
readable logic representative of an exploit-signature" as recited by Claim 11. Therefore, for 
at least this reason also, Claim 1 1 is patentable over the cited references. 
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Moreover, Claim 11 recites "the node operable to transmit the signature file to a 
mobile, device over a radio frequency link" (emphasis added). In the Office Action, the 
Examiner appears to ignore at least the emphasized portion of the above-referenced 
limitation(s) ("and the node operable to transmit the signature file to a radio frequency link" 
(Office Action, pages 6-7)). Applicants respectfully submit that neither Holland nor Smaha, 
alone or in combination, appears to disclose, teach or suggest that "the node [is] operable to 
transmit the signature file to a mobile device over a radio frequency link" as recited by Claim 
11. Therefore, for at least this reason also, Claim 1 1 is patentable over the cited references. 

Claims 12 and 13 depend from independent Claim 11. For at least the reasons 
discussed above, Claim 11 is patentable over the cited references. Therefore, Claims 12 and 
13 are also patentable, and Applicants respectfully request that the rejection of Claims 12 and 
13 be withdrawn. 
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CONCLUSION 



Applicants have made an earnest attempt to place this case in condition for immediate 
allowance. For the foregoing reasons and for other reasons clearly apparent, Applicants 
respectfully request reconsideration and full allowance of all pending claims. 

No fee is believed due with this Response. If, however, Applicant has overlooked the 
need for any fee due with this Response, the Commissioner is hereby authorized to charge any 
fees or credit any overpayment associated with this Response to Deposit Account No. 08- 
2025 of Hewlett-Packard Company. 



Date: Tune 77 2005 

Correspondence to: 

LJoy Griebenow 

Hewlett-Packard Company 

Intellectual Property Administration 

P. O. Box 272400 

Fort Collins, CO 80527-2400 

Tel. 970-898-3884 



Respectfully submitted, 




Reg. No. 43,486 
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